Remove tag open-source-security
article thumbnail

How to make your web application more secure by using Dynamic Application Security Testing (DAST) – PART 2 of Application Security Testing series

Xebia

Introduction Welcome to part two of the Application Security Testing series. Like I mentioned in the previous blog, during this blog series we are going to look at the different types of Application Security Testing and Software Composition Analysis. This time we will focus on Dynamic Application Security Testing (DAST).

article thumbnail

Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows

Prisma Clud

As we discussed in the previous blog post, Third-Party GitHub Actions: Effects of an Opt-Out Permission Model , the permissive nature of GitHub Actions workflows is prevalent throughout the open-source community and private projects on GitHub. The action pulls the latest tag — but it’s mutable and subject to change.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Trending Sources

article thumbnail

The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree

Prisma Clud

Learn how a novel attack vector in GitHub Actions allows attackers to distribute malware across repositories using a technique that exploits the actions dependency tree and puts countless open-source projects and internal repositories at risk. Reference a tag. Reference a commit hash. Reference a branch.

Malware 144
article thumbnail

Databricks acquires AI-centric data governance platform Okera

TechCrunch

. “Historically, data governance technologies, regardless of sophistication, rely on enforcing control at some narrow waist layer and require workloads to fit into the ‘walled garden’ at this layer,” the company explains in a blog post. What they need is a modern, AI-centric governance solution.

article thumbnail

Our Latest Open Source Innovation, Yor: Automated IaC Tag and Trace

Palo Alto Networks

While sitting in a security operations center (SOC) in the middle of a high-severity incident, you realize Secure Shell Protocol (SSH) (port 22) is open to the world. To make that process easier to navigate, many organizations leverage cloud tagging as a scalable way to attribute cloud resources to organizational owners.

article thumbnail

Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action

Tenable

And the NSA is sharing best practices for data security. Cybersecurity and Infrastructure Security Agency (CISA) in its Emergency Directive 24-02 , sent to federal civilian agencies last week and made public this week. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. And much more!

article thumbnail

Strengthening the Nessus Software Supply Chain with SLSA

Tenable

But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you. What is SLSA?